---
title: "Run a search query within a collection"
method: POST
path: "/v3/collections/{collection_uid}/search/query"
tags: ["Collections"]
---

# Run a search query within a collection

`POST /v3/collections/{collection_uid}/search/query`

Run a search query across a collection's assets. Reference the [documentation on Censys Query Language](https://docs.censys.com/docs/censys-query-language#/) for information about query syntax. Host services that match your search criteria will be returned in a `matched_services` object.

## Path parameters

- `collection_uid` string, required — The UID for the collection

## Query parameters

- `organization_id` string, uuid, required — The ID of a Censys organization to associate the request with. See the [Getting Started docs](https://docs.censys.com/reference/get-started#step-3-find-and-use-your-organization-id-optional) for more information.

## Headers

- `X-Organization-ID` string, uuid — The ID of a Censys organization to associate the request with. See the [Getting Started docs](https://docs.censys.com/reference/get-started#step-3-find-and-use-your-organization-id-optional) for more information. Note: The header parameter is supported for atypical use cases; we recommend always providing this field via the query parameter.

## Request body

- SearchQueryInputBody
  - `fields` string[], nullable — Specify fields to only return in the response. If you provide fields and omit `host.services.port`, `host.services.transport_protocol`, and `host.services.protocol`, then `matched_services` will not be returned in the response.
  - `page_size` integer, nullable — Number of results to return to per page. The default and maximum is 100.
  - `page_token` string — page token for the requested page of search results
  - `query` string, required — CenQL query string to search upon

## Response `200`

OK

- ResponseEnvelopeSearchQueryResponse
  - `result` SearchQueryResponse
    - `hits` SearchQueryHit[], nullable, required
      - `certificate_v1` CertificateAsset
        - `extensions` object, required
        - `resource` Certificate, required
          - `added_at` string — When the certificate was added to the Censys dataset.
          - `ct` Ct
            - `entries` object
          - `ever_seen_in_scan` boolean — Whether the certificate has ever been presented by a service during a scan.
          - `fingerprint_md5` string, hex — The MD-5 digest of the entire raw certificate. An identifier used by some systems.
          - `fingerprint_sha1` string, hex — The SHA-1 digest of the entire raw certificate. An identifier used by some systems.
          - `fingerprint_sha256` string, hex — The SHA-256 digest of the entire raw certificate. Its unique identifier, which Censys uses to index certificates records.
          - `modified_at` string — When the certificate record was last modified.
          - `names` string[], nullable — All the names contained in the certificate from various fields.
          - `parent_spki_fingerprint_sha256` string, hex — DEPRECATED: Use parent_spki_subject_fingerprint_sha256
          - `parent_spki_subject_fingerprint_sha256` string, hex — The SHA-256 digest of the parent certificate's DER-encoded SubjectPublicKeyInfo concatenated with its Subject.
          - `parse_status` '' | 'success' | 'fail' | 'corrupted'
          - `parsed` CertificateParsed
            - `extensions` CertificateExtensions
              - …
            - `issuer` DistinguishedName
              - …
            - `issuer_dn` string — Distinguished Name of the entity that has signed and issued the certificate.
            - `ja4x` string
            - `redacted` boolean
            - `serial_number` string — Issuer-specific identifier of the certificate.
            - `serial_number_hex` string — Issuer-specific identifier of the certificate, represented as hexadecimal.
            - `signature` Signature
              - …
            - `subject` DistinguishedName
              - …
            - `subject_dn` string — Distinguished Name of the entity associated with the public key.
            - `subject_key_info` SubjectKeyInfo
              - …
            - `unknown_extensions` Extension[], nullable
              - …
            - `validity_period` ValidityPeriod
              - …
            - `version` integer
          - `precert` boolean — Whether the X.509 "poison" extension (OID: 1.3.6.1.4.1.11129.2.4.3) is marked critical, which prohibits the pre-certificate from being trusted.
          - `revocation` CertificateRevocation
            - `crl` CertificateRevocationRevocationInfo
              - …
            - `ocsp` CertificateRevocationRevocationInfo
              - …
          - `revoked` boolean — Whether the certificate has been revoked before its expiry date by the issuer.
          - `spki_fingerprint_sha256` string, hex — DEPRECATED: Use spki_subject_fingerprint_sha256
          - `spki_subject_fingerprint_sha256` string, hex — The SHA-256 digest of the certificate's DER-encoded SubjectPublicKeyInfo concatenated with its Subject.
          - `tbs_fingerprint_sha256` string, hex — The SHA-256 digest of the unsigned certificate's contents.
          - `tbs_no_ct_fingerprint_sha256` string, hex — The SHA-256 digest of the unsigned certificate with the CT Poison extension removed, if present. This represents the shared contents of a certificate and its corresponding pre-certificate.
          - `validated_at` string — When the certificate record's trust was last checked.
          - `validation` Validation
            - `apple` RootStore
              - …
            - `chrome` RootStore
              - …
            - `microsoft` RootStore
              - …
            - `nss` RootStore
              - …
          - `validation_level` '' | 'dv' | 'ov' | 'ev' — The extent to which the certificate's issuer validated the identity of the entity requesting the certificate. Options include Domain validated (DV), Organization Validated (OV), or Extended Validation (EV).
          - `zlint` ZLint
            - `errors_present` boolean — Whether the certificate's attributes triggered any error lints for non-conformance to the X.509 standard.
            - `failed_lints` string[], nullable — A list of lint names which failed, if applicable.
            - `fatals_present` boolean — Whether the certificate's attributes triggered any fatal lints for non-conformance to the X.509 standard.
            - `notices_present` boolean — Whether the certificate's attributes triggered any notice lints for non-conformance to the X.509 standard.
            - `timestamp` string — An RFC-3339-formated timestamp indicating when the certificate was linted.
            - `version` integer — The version of Zlint used to lint the certificate.
            - `warnings_present` boolean — Whether the certificate's attributes triggered any warning lints for non-conformance to the X.509 standard.
      - `host_v1` HostAssetWithMatchedServices
        - `extensions` object, required
        - `matched_services` MatchedService[], nullable — The host services that match the query.
          - `port` integer
          - `protocol` string
          - `transport_protocol` '' | 'tcp' | 'udp' | 'icmp' | 'quic'
        - `resource` Host, required
          - `autonomous_system` Routing
            - `asn` integer — The ASN (autonomous system number) of the host's autonomous system.
            - `bgp_prefix` string — The autonomous system's CIDR.
            - `country_code` string — The autonomous system's two-letter ISO 3166-1 alpha-2 country code (US, CN, GB, RU, ...).
            - `description` string — Brief description of the autonomous system.
            - `name` string — The friendly name of the autonomous system.
            - `organization` string — The name of the organization managning the autonomous system.
          - `dns` HostDns
            - `forward_dns` object
            - `names` string[], nullable
            - `reverse_dns` HostDnsReverseResolution
              - …
          - `greynoise` Greynoise
            - `actor` string — The actor that was observed.
            - `classification` string — The classification of the IP address.
            - `last_observed_time` string — The last time the IP address was observed.
            - `tags` GreynoiseTag[], nullable — The tags associated with the IP address.
              - …
          - `hardware` Attribute
            - `components` CPE[], nullable
              - …
            - `confidence` number, double
            - `cpe` string
            - `edition` string
            - `evidence` Evidence[], nullable
              - …
            - `life_cycle` CPELifeCycle
              - …
            - `part` string
            - `product` string
            - `source` '' | 'censys' | 'recog' | 'wappalyzer' | 'third_party' | 'html_meta_extractor'
            - `type` string[], nullable
            - `update` string
            - `vendor` string
            - `version` string
          - `ip` string
          - `labels` Label[], nullable
            - `confidence` number, double
            - `evidence` Evidence[], nullable
              - …
            - `source` '' | 'censys' | 'recog' | 'wappalyzer' | 'third_party' | 'html_meta_extractor'
            - `value` string
          - `location` Location
            - `city` string — The English name of the detected city.
            - `continent` string — The English name of the detected continent (North America, Europe, Asia, South America, Africa, Oceania, Antarctica).
            - `coordinates` Coordinates
              - …
            - `country` string — The English name of the detected country.
            - `country_code` string — The detected two-letter ISO 3166-1 alpha-2 country code (US, CN, GB, RU, ...).
            - `postal_code` string — The postal code (if applicable) of the detected location.
            - `province` string — The state or province name of the detected location.
            - `registered_country` string — The English name of the registered country.
            - `registered_country_code` string — The registered country's two-letter ISO 3166-1 alpha-2 country code (US, CN, GB, RU, ...).
            - `timezone` string — The IANA time zone database name of the detected location.
          - `network` NetworkClassification[], nullable — Information about what type of network the host belongs to.
            - `hosting` boolean — Whether the host belongs to an Internet hosting service provider.
            - `mobile` boolean — Whether the host belongs to a mobile network.
            - `mobile_info` NetworkMobileInfo
              - …
            - `satellite` boolean — Whether the host belongs to a statellite network.
            - `source` string — The source of the data.
          - `operating_system` Attribute
            - `components` CPE[], nullable
              - …
            - `confidence` number, double
            - `cpe` string
            - `edition` string
            - `evidence` Evidence[], nullable
              - …
            - `life_cycle` CPELifeCycle
              - …
            - `part` string
            - `product` string
            - `source` '' | 'censys' | 'recog' | 'wappalyzer' | 'third_party' | 'html_meta_extractor'
            - `type` string[], nullable
            - `update` string
            - `vendor` string
            - `version` string
          - `privacy` Privacy[], nullable — Information about privacy services used by the IP, such as VPNs, Proxies, or Tor.
            - `anonymous` boolean — Whether the host uses any kind of privacy service.
            - `proxy` boolean — Whether the host is an open web proxy.
            - `relay` boolean — Whether the host is a location-preserving anonymous relay service, like iCloud Private Relay..
            - `service_provider` string[], nullable — The name of the privacy service providers detected.
            - `source` string — The source of the data.
            - `tor` boolean — Whether the host is a Tor exit node.
            - `tor_info` PrivacyTorInfo
              - …
            - `vpn` boolean — Whether the host is a VPN service exit node IP address.
          - `reputation` Reputation
            - `evidence` ReputationEvidence[], nullable
              - …
            - `model_version` string
            - `score` number, float
            - `score_level` '' | 'benign' | 'low_risk' | 'medium_risk' | 'high_risk' | 'malicious'
          - `service_count` integer
          - `services` Service[], nullable
            - `activemq` Activemq
              - …
            - `amqp` Amqp
              - …
            - `anerma_cf_forth` AnermaCfForth
              - …
            - `any_connect` AnyConnect
              - …
            - `asterisk_manager_interface` AsteriskManagerInterface
              - …
            - `bacnet` Bacnet
              - …
            - `banner` string, utf8
            - `banner_hash_sha256` string, hex
            - `banner_hex` string
            - `cert` Certificate
              - …
            - `checkpoint_topology` CheckpointTopology
              - …
            - `chromecast` Chromecast
              - …
            - `cisco_ipsla` CiscoIpsla
              - …
            - `clickhouse_native` ClickHouseNative
              - …
            - `cmore` Cmore
            - `coap` Coap
              - …
            - `compromises` Risk[], nullable
              - …
            - `cortex_xdr_p2p` CortexXdrP2P
              - …
            - `crestron_cp3` CrestronCp3
              - …
            - `crestron_din_ap2` CrestronDinAp2
              - …
            - `cursor_on_target` CursorOnTarget
              - …
            - `cwmp` Cwmp
              - …
            - `darkcomet` Darkcomet
              - …
            - `darkgate` Darkgate
              - …
            - `dcerpc` Dcerpc
              - …
            - `denon_heos` DenonHeos
              - …
            - `dhcpdiscover` Dhcpdiscover
              - …
            - `dicom` Dicom
              - …
            - `dnp3` Dnp3
            - `dns` Dns
              - …
            - `dotnet_negotiate_stream` DotnetNegotiateStream
              - …
            - `dtls` Dtls
            - `dvr_ip` DvrIp
              - …
            - `eip` Eip
              - …
            - `elasticsearch_transport` ElasticsearchTransport
              - …
            - `elf_file` ElfFile
              - …
            - `endpoints` EndpointScanState[], nullable
              - …
            - `epmd` Epmd
              - …
            - `etcd` Etcd
              - …
            - `ethereum` Ethereum
              - …
            - `exposures` Risk[], nullable
              - …
            - `fins` Fins
              - …
            - `flash_socket_policy` FlashSocketPolicy
              - …
            - `fox` Fox
              - …
            - `frps` Frps
              - …
            - `ftp` Ftp
              - …
            - `gearman` Gearman
              - …
            - `gemini` Gemini
              - …
            - `giop` Giop
              - …
            - `gopher` Gopher
              - …
            - `hajime` Hajime
              - …
            - `hardware` Attribute[], nullable
              - …
            - `hid_vertx` HidVertx
              - …
            - `hikvision` Hikvision
              - …
            - `ibmnje` Ibmnje
              - …
            - `icap` Icap
              - …
            - `iec60870_5_104` Iec608705104
              - …
            - `ike` Ike
              - …
            - `imap` Imap
              - …
            - `iota` Iota
              - …
            - `ip` string
            - `ipmi` Ipmi
              - …
            - `ipp` Ipp
              - …
            - `isc_dhcp_omapi` IscDhcpOmapi
              - …
            - `iscsi` Iscsi
              - …
            - `ja4tscan` JA4TScanScan
              - …
            - `jarm` JarmScan
              - …
            - `java_rmi` JavaRmi
              - …
            - `kcodes_netusb` KcodesNetusb
              - …
            - `krpc` Krpc
              - …
            - `l2tp` L2Tp
              - …
            - `labels` Label[], nullable
              - …
            - `ldap` Ldap
              - …
            - `lpd` Lpd
              - …
            - `mavlink` Mavlink
              - …
            - `mdns` Mdns
              - …
            - `melsec` Melsec
              - …
            - `memberlist` Memberlist
              - …
            - `memcached` Memcached
              - …
            - `mikrotik_winbox` MikrotikWinbox
              - …
            - `minecraft` Minecraft
              - …
            - `misconfigs` Risk[], nullable
              - …
            - `mms` Mms
              - …
            - `modbus` Modbus
              - …
            - `monero_p2p` MoneroP2P
              - …
            - `mongodb` Mongodb
              - …
            - `mqtt` Mqtt
              - …
            - `mssql` Mssql
              - …
            - `murmur` Murmur
              - …
            - `mysql` Mysql
              - …
            - `mysqlx` Mysqlx
              - …
            - `nats_io` NatsIo
              - …
            - `nbd` Nbd
              - …
            - `nfs_mountd` NfsMountd
              - …
            - `nmea` Nmea
              - …
            - `ntp` Ntp
              - …
            - `ntrip` Ntrip
              - …
            - `onc` Onc
            - `onvif` Onvif
              - …
            - `opc_ua` OpcUa
              - …
            - `openflow` Openflow
              - …
            - `openvpn` Openvpn
              - …
            - `openvpn_mgmt` OpenvpnMgmt
              - …
            - `operating_systems` Attribute[], nullable
              - …
            - `oracle` Oracle
              - …
            - `pc_anywhere` PcAnywhere
              - …
            - `perforce_p4d` PerforceP4D
              - …
            - `pgbouncer` Pgbouncer
              - …
            - `pop3` Pop3
              - …
            - `port` integer
            - `portmap` Portmap
              - …
            - `postgres` Postgres
              - …
            - `pptp` Pptp
              - …
            - `profinet_cm` ProfinetCm
              - …
            - `protocol` string
            - `qdrant_grpc` QdrantGrpc
              - …
            - `r1soft_buagent` R1SoftBuagent
              - …
            - `rdate` Rdate
              - …
            - `rdp` Rdp
              - …
            - `realport` Realport
              - …
            - `redis` Redis
              - …
            - `redline` Redline
              - …
            - `redlion_crimson` RedlionCrimson
              - …
            - `reolink_baichuan` ReolinkBaichuan
              - …
            - `representative_info` RepresentativeInfo
              - …
            - `rifatron` Rifatron
              - …
            - `ripple` Ripple
              - …
            - `rlogin` Rlogin
              - …
            - `rocketmq` Rocketmq
              - …
            - `routeros_api` RouterosApi
              - …
            - `rtmp` Rtmp
              - …
            - `rtsp` Rtsp
              - …
            - `rustdesk_heartbeat` RustdeskHeartbeat
              - …
            - `rustdesk_relay` RustdeskRelay
              - …
            - `rustdesk_rendezvous` RustdeskRendezvous
              - …
            - `s7` S7
              - …
            - `sap_router` SapRouter
              - …
            - `sapient` Sapient
              - …
            - `scan_time` string
            - `scpi` Scpi
              - …
            - `screenshots` Screenshot[], nullable
              - …
            - `ser2net` Ser2Net
              - …
            - `seven_days_to_die` SevenDaysToDie
              - …
            - `sip` Sip
              - …
            - `skinny` Skinny
              - …
            - `smb` Smb
              - …
            - `smtp` Smtp
              - …
            - `snmp` Snmp
              - …
            - `socks` Socks
              - …
            - `software` Attribute[], nullable
              - …
            - `spice` Spice
              - …
            - `ssdp` Ssdp
              - …
            - `ssh` Ssh
              - …
            - `steam` Steam
              - …
            - `stun` Stun
              - …
            - `syncthing_bep` SyncthingBep
              - …
            - `synergy` Synergy
              - …
            - `tacacs_plus` TacacsPlus
              - …
            - `tarantool` Tarantool
              - …
            - `team_viewer` TeamViewer
              - …
            - `telexper_tlxp` TelexperTlxp
              - …
            - `telnet` Telnet
              - …
            - `threats` Threat[], nullable
              - …
            - `tibia` Tibia
              - …
            - `tls` Tls
              - …
            - `tplink_kasa` TplinkKasa
              - …
            - `transport_protocol` '' | 'tcp' | 'udp' | 'icmp' | 'quic'
            - `twamp_control` TwampControl
              - …
            - `unitronics_pcom` UnitronicsPcom
              - …
            - `upnp` Upnp
              - …
            - `ventrilo` Ventrilo
              - …
            - `vnc` Vnc
              - …
            - `vulns` Vuln[], nullable
              - …
            - `weblogic_t3` WeblogicT3
              - …
            - `wince_cerdisp` WinceCerdisp
              - …
            - `winrm` Winrm
              - …
            - `ws_discovery` WsDiscovery
              - …
            - `x11` X11
              - …
            - `zeromq` Zeromq
              - …
          - `whois` Whois
            - `network` Network
              - …
            - `organization` Organization
              - …
      - `tags` SearchQueryTagInfo[], nullable — Tags applied to this asset.
        - `display_name` string, required — Name of the tag.
        - `id` string, uuid — ID of the tag.
      - `webproperty_v1` WebpropertyAsset
        - `extensions` object, required
        - `resource` Webproperty, required
          - `cert` Certificate
            - `added_at` string — When the certificate was added to the Censys dataset.
            - `ct` Ct
              - …
            - `ever_seen_in_scan` boolean — Whether the certificate has ever been presented by a service during a scan.
            - `fingerprint_md5` string, hex — The MD-5 digest of the entire raw certificate. An identifier used by some systems.
            - `fingerprint_sha1` string, hex — The SHA-1 digest of the entire raw certificate. An identifier used by some systems.
            - `fingerprint_sha256` string, hex — The SHA-256 digest of the entire raw certificate. Its unique identifier, which Censys uses to index certificates records.
            - `modified_at` string — When the certificate record was last modified.
            - `names` string[], nullable — All the names contained in the certificate from various fields.
            - `parent_spki_fingerprint_sha256` string, hex — DEPRECATED: Use parent_spki_subject_fingerprint_sha256
            - `parent_spki_subject_fingerprint_sha256` string, hex — The SHA-256 digest of the parent certificate's DER-encoded SubjectPublicKeyInfo concatenated with its Subject.
            - `parse_status` '' | 'success' | 'fail' | 'corrupted'
            - `parsed` CertificateParsed
              - …
            - `precert` boolean — Whether the X.509 "poison" extension (OID: 1.3.6.1.4.1.11129.2.4.3) is marked critical, which prohibits the pre-certificate from being trusted.
            - `revocation` CertificateRevocation
              - …
            - `revoked` boolean — Whether the certificate has been revoked before its expiry date by the issuer.
            - `spki_fingerprint_sha256` string, hex — DEPRECATED: Use spki_subject_fingerprint_sha256
            - `spki_subject_fingerprint_sha256` string, hex — The SHA-256 digest of the certificate's DER-encoded SubjectPublicKeyInfo concatenated with its Subject.
            - `tbs_fingerprint_sha256` string, hex — The SHA-256 digest of the unsigned certificate's contents.
            - `tbs_no_ct_fingerprint_sha256` string, hex — The SHA-256 digest of the unsigned certificate with the CT Poison extension removed, if present. This represents the shared contents of a certificate and its corresponding pre-certificate.
            - `validated_at` string — When the certificate record's trust was last checked.
            - `validation` Validation
              - …
            - `validation_level` '' | 'dv' | 'ov' | 'ev' — The extent to which the certificate's issuer validated the identity of the entity requesting the certificate. Options include Domain validated (DV), Organization Validated (OV), or Extended Validation (EV).
            - `zlint` ZLint
              - …
          - `compromises` Risk[], nullable
            - `confidence` number, double
            - `cvss` CVSS
              - …
            - `evidence` Evidence[], nullable
              - …
            - `id` string
            - `metrics` Metrics
              - …
            - `name` string
            - `risk_source` '' | 'censys' | 'cve'
            - `severity` '' | 'low' | 'medium' | 'high' | 'critical'
            - `source` '' | 'censys' | 'recog' | 'wappalyzer' | 'third_party' | 'html_meta_extractor'
            - `type` string[], nullable
            - `year` integer
          - `endpoints` EndpointScanState[], nullable
            - `argocd` Argocd
              - …
            - `banner` string, utf8
            - `banner_hash_sha256` string, hex
            - `chrome_devtools` ChromeDevtools
              - …
            - `clickhouse_http` ClickHouseHttp
              - …
            - `cobalt_strike` CobaltStrike
              - …
            - `elasticsearch` ElasticSearch
              - …
            - `endpoint_type` string
            - `extracted` ExtractedEndpointData
              - …
            - `fortigate` Fortigate
              - …
            - `graphql` Graphql
              - …
            - `hostname` string
            - `http` Http
              - …
            - `influxdb` Influxdb
              - …
            - `ip` string
            - `ivanti_avalanche` IvantiAvalanche
              - …
            - `jenkins` Jenkins
              - …
            - `jupyter` Jupyter
              - …
            - `keycloak` Keycloak
              - …
            - `kubernetes` Kubernetes
              - …
            - `mcp` Mcp
              - …
            - `nginx_proxy_manager` NginxProxyManager
              - …
            - `ollama` Ollama
              - …
            - `open_directory` OpenDirectory
              - …
            - `path` string
            - `plex_media_server` PlexMediaServer
              - …
            - `port` integer
            - `pprof` Pprof
              - …
            - `prometheus` Prometheus
              - …
            - `prometheus_target` PrometheusTarget
              - …
            - `proxmox_ve` ProxmoxVe
              - …
            - `redlion_web` RedlionWeb
              - …
            - `scada_view` ScadaView
              - …
            - `scan_time` string
            - `screenshots` Screenshot[], nullable
              - …
            - `synology_dsm` SynologyDsm
              - …
            - `transport_protocol` '' | 'tcp' | 'udp' | 'icmp' | 'quic'
            - `vault` Vault
              - …
            - `wordpress` Wordpress
              - …
          - `exposures` Risk[], nullable
            - `confidence` number, double
            - `cvss` CVSS
              - …
            - `evidence` Evidence[], nullable
              - …
            - `id` string
            - `metrics` Metrics
              - …
            - `name` string
            - `risk_source` '' | 'censys' | 'cve'
            - `severity` '' | 'low' | 'medium' | 'high' | 'critical'
            - `source` '' | 'censys' | 'recog' | 'wappalyzer' | 'third_party' | 'html_meta_extractor'
            - `type` string[], nullable
            - `year` integer
          - `hardware` Attribute[], nullable
            - `components` CPE[], nullable
              - …
            - `confidence` number, double
            - `cpe` string
            - `edition` string
            - `evidence` Evidence[], nullable
              - …
            - `life_cycle` CPELifeCycle
              - …
            - `part` string
            - `product` string
            - `source` '' | 'censys' | 'recog' | 'wappalyzer' | 'third_party' | 'html_meta_extractor'
            - `type` string[], nullable
            - `update` string
            - `vendor` string
            - `version` string
          - `hostname` string
          - `jarm` JarmScan
            - `cipher_and_version_fingerprint` string, hex — The first 30 character portion of the Jarm fingerprint.
            - `fingerprint` string, hex — The 62 character Jarm fingerprint of the service.
            - `hostname` string
            - `ip` string
            - `is_success` boolean
            - `port` integer
            - `scan_time` string — The time the service was fingerprinted
            - `tls_extensions_sha256` string, hex — The second 32 character portion of the Jarm fingerprint
            - `transport_protocol` '' | 'tcp' | 'udp' | 'icmp' | 'quic'
          - `labels` Label[], nullable
            - `confidence` number, double
            - `evidence` Evidence[], nullable
              - …
            - `source` '' | 'censys' | 'recog' | 'wappalyzer' | 'third_party' | 'html_meta_extractor'
            - `value` string
          - `misconfigs` Risk[], nullable
            - `confidence` number, double
            - `cvss` CVSS
              - …
            - `evidence` Evidence[], nullable
              - …
            - `id` string
            - `metrics` Metrics
              - …
            - `name` string
            - `risk_source` '' | 'censys' | 'cve'
            - `severity` '' | 'low' | 'medium' | 'high' | 'critical'
            - `source` '' | 'censys' | 'recog' | 'wappalyzer' | 'third_party' | 'html_meta_extractor'
            - `type` string[], nullable
            - `year` integer
          - `operating_systems` Attribute[], nullable
            - `components` CPE[], nullable
              - …
            - `confidence` number, double
            - `cpe` string
            - `edition` string
            - `evidence` Evidence[], nullable
              - …
            - `life_cycle` CPELifeCycle
              - …
            - `part` string
            - `product` string
            - `source` '' | 'censys' | 'recog' | 'wappalyzer' | 'third_party' | 'html_meta_extractor'
            - `type` string[], nullable
            - `update` string
            - `vendor` string
            - `version` string
          - `port` integer
          - `scan_time` string
          - `software` Attribute[], nullable
            - `components` CPE[], nullable
              - …
            - `confidence` number, double
            - `cpe` string
            - `edition` string
            - `evidence` Evidence[], nullable
              - …
            - `life_cycle` CPELifeCycle
              - …
            - `part` string
            - `product` string
            - `source` '' | 'censys' | 'recog' | 'wappalyzer' | 'third_party' | 'html_meta_extractor'
            - `type` string[], nullable
            - `update` string
            - `vendor` string
            - `version` string
          - `threats` Threat[], nullable
            - `actors` ThreatActor[], nullable
              - …
            - `confidence` number, double
            - `details` ThreatDetails
              - …
            - `evidence` Evidence[], nullable
              - …
            - `id` string
            - `malware` ThreatMalware
              - …
            - `name` string
            - `source` '' | 'censys' | 'recog' | 'wappalyzer' | 'third_party' | 'html_meta_extractor'
            - `tactic` string[], nullable
            - `type` string[], nullable
          - `tls` Tls
            - `cipher_selected` string — Cipher suite chosen for the exchange.
            - `fingerprint_sha256` string, hex — The SHA-256 digest of the entire raw certificate. Its unique identifier, which Censys uses to index certificates records.
            - `ja3s` string, hex — The JA3S fingerprint for this service.
            - `ja4s` string
            - `presented_chain` TlsChain[], nullable — Certificate chain information.
              - …
            - `version_selected` '' | 'ss_lv_2' | 'ss_lv_3' | 'tlsv1_0' | 'tlsv1_1' | 'tlsv1_2' | 'tlsv1_3' | 'dtlsv1_0' | 'dtlsv1_2' | 'dtlsv1_3' — Certificate version v1(0), v2(1), v3(2).
            - `versions` TlsVersionData[], nullable
              - …
          - `vulns` Vuln[], nullable
            - `confidence` number, double
            - `cwes` CWE[], nullable
              - …
            - `evidence` Evidence[], nullable
              - …
            - `id` string
            - `kev` KEV[], nullable
              - …
            - `metrics` Metrics
              - …
            - `name` string
            - `risk_source` '' | 'censys' | 'cve'
            - `severity` '' | 'low' | 'medium' | 'high' | 'critical'
            - `source` '' | 'censys' | 'recog' | 'wappalyzer' | 'third_party' | 'html_meta_extractor'
            - `type` string[], nullable
            - `year` integer
    - `next_page_token` string, required
    - `previous_page_token` string, required
    - `query_duration_millis` integer, required
    - `total_hits` number, double, required

## Other responses

- `400` — Bad request
- `401` — Request does not contain a valid Authorization token
- `403` — User does not have permission to access this data
- `404` — No collection found
- `422` — Invalid input
- `500` — Internal server error

---

[API](https://skmtc.net/censys/apis/censys-platform-api.md) · [All operations](https://skmtc.net/censys/apis/censys-platform-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/censys/censys-platform-api/versions/261c916bf05b/schema)